TI-2026-12975 Aliases CVE-2026-15419 GHSA-56c3-4jhx-hj8g

CP210x Driver Memory Corruption results in Arbitrary Code Execution

LOW 32CWE-121Published 2026-09-10 · Updated 2026-09-10

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to corrupt kernel pool memory, resulting in arbitrary code execution with escalated privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00227 13th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
silabs.com	silabser.sys driver	up to 11.5.0	—	No fix listed	CNA

silabser.sys driver Vendorsilabs.com Affected up to 11.5.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-09-10
Silicon Labs silabser.sys driver — siliconlabs.lightning.force.com/sfc/servlet.shepherd/docume…
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-12973 CP210x Denial of ServicePriority LOW 30
- TI-2026-12974 CP210x Memory LeakagePriority LOW 12
Show all 3 records → Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-15419
2026-10-03 Alias added: GHSA-56c3-4jhx-hj8g

References

Advisory 1

https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm0000100HA6IAM?operationContext=S1

TI-2023-24288 Heap-based buffer overflow in silabs.com Gecko Platform CVSS 3.1CRITICAL 10.0
TI-2023-14952 Memory corruption in silabs.com Gecko Platform CVSS 3.1CRITICAL 9.8
TI-2023-12925 Memory corruption in silabs.com Gecko Platform CVSS 3.1CRITICAL 9.8
TI-2023-12476 Heap-based buffer overflow in silabs.com Gecko Platform CVSS 3.1CRITICAL 9.8
TI-2022-08744 Heap-based buffer overflow in MicriumOS HTTP Server allows potential remote code execution CVSS 3.1CRITICAL 9.8
TI-2023-12937 Memory corruption in silabs.com Gecko Platform CVSS 3.1CRITICAL 9.8

See all 178 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences